A processing system may include hardware resources, such as a central processing unit (CPU), random access memory (RAM), and nonvolatile storage such as read only memory (ROM) and one or more hard disk drives. The processing system may also include data and software resources, such as a basic input/output system (BIOS), a hypervisor or virtual machine monitor (VMM), and one or more operating systems (OSs). When the processing system is started or reset, it may load and run the BIOS. The processing system may then load and run one or more of the VMM and the OSs.
The data stored in a processing system may have high value. The data may include trade secrets and other confidential business data or personal information such as social security numbers and credit card numbers. In addition, processing systems are frequently used for electronic business transactions. To improve computer security, the Trusted Computing Group (TCG), a not-for-profit industry-standards organization, has formed and adopted specifications for more secure processing systems.
TCG specifications define trusted processing system platforms, computer platforms which may behave in a particular manner for a specific purpose. A trusted platform may provide data security functions such as data encryption and decryption and data storage. A key component of a trusted platform is the trusted platform module (TPM). A TPM which may perform operations such as cryptographic hashes to detect loss of integrity, public and secret key encryption to prevent unauthorized disclosure of data, and digital signing to authenticate transmitted information. The TCG Protected Storage mechanisms, which may be rooted in hardware, may be used to protect keys, secrets and hash values. Additional details on TPMs may be found in specifications such as the Trusted Computing Group (TCG) TPM Specification Version 1.2, dated Oct. 2, 2003 (hereinafter the “TPM specification”), which includes parts such as Design Principles, Structures of the TPM, and TPM Commands. The TPM specification is published by the TCG and is currently available from the Internet at www.trustedcomputinggroup.org/home.
A trusted platform may also demonstrate that it operates in a safe configuration when it has access to confidential data by measuring the configuration and sealing the data to the configuration. TCG specifications provide for measuring the components of a computer platform and for storing the results of the measurements. The measurements of a configuration may be hashed and stored in platform configuration registers (PCRs). A trusted platform may allow access to data only under a particular configuration of the trusted platform. The TPM seal operation may encrypt data to a specific set of PCR values or an authorization value. To unseal the data, and thereby gain access to it, the authorization must be presented and the set of values stored in the PCRs must match the set used in the seal operation. Similarly, a signing key may be locked to a set of PCR values during key generation within the TPM.
Changes in a platform configuration may render sealed data or PCR locked keys inaccessible. To gain access to sealed data under a modified configuration, the data may first have to be accessed under the original configuration and resealed to the modified configuration. Gaining access to the data may prove difficult when the data is distributed over multiple computer platforms. Generally, keys locked to a particular platform configuration are not accessible from other configurations.